This is just a quick hack that can determin the OS based on fingerprints of
packets on the network.  Lance Spitzner originally wrote a white paper
detailing the differences in packet info and described a way to try and
determine what OS the sender was using based on packet logs.  This is merely
a proof-of-concept of that white paper.  For more white papers by
Lance Spitzner (http://www.enteract.com/~lspitz)

This script is licensed under the GPL see COPYING for more info.

YOU'LL NEED
-----------
Net::RawIP	- You can get this from CPAN
libpcap		- If your distro doesn't have it check the README for RawIP

SYNTAX
------
./passivefingerprint.pl [store|print]

Without any options the program will watch all tcp packets and print an
OS guess.  There are two optional arguments (store and print):

store - Saves IP & OS to a berkely level 1 database file (traffic.db)
print - Prints this database file

The fingerprint file is called fingerprints.dat.  This file contains
the database to determine the OS based on packet info (DF, TTL, WINDOWSIZE)

MODIFICATIONS
-------------
Version 0.2
TOS is no longer used as a signature.  TOS is application dependent, so 
the same OS may have different TOS values depending on the application used 
(finger, telnet, ftp, etc..)

AUTHOR INFO
-----------
Craig Smith (April 2000) craig@lintrox.com
